Dotdog 1.0.0

Dotdog 1.0 brings local-first spec/code graphs, saved native-analysis evidence, and selected type contracts into one CLI/MCP package.

Highlights

• Spec-driven workflows: preserve human intent separately from observed code; refresh repository graphs and ask bounded context, impact and path questions. Repository-local Codex/Claude skills and removable opt-in hooks reuse the CLI.
• REA/Ghidra graphs: import saved REA NativeCallGraph exports with explicit producer direction, artifact identity, coverage and limitations. Query them without executing a binary or launching another decompiler.
• Type-driven module: opt-in inspection of selected TypeScript 7.0.2 exports, signatures, diagnostics and bounded declared-type references. Preserve original project configuration and source evidence without declaration emit or automatic compiler installation.
• Hardening and performance: atomic generated writes, ownership locks, symlink/input bounds, validated hook settings, explicit provider checks, parent-link BFS and shared parser chunks. No mandatory runtime npm dependency or new service.

Install or upgrade

With npm:

npm install -g dotdog@1.0.0
dotdog --version
dotdog refresh --json

With Bun, including Bun-only environments:

bunx --bun dotdog@1.0.0 --version
bunx --bun dotdog@1.0.0 refresh --json

Run refresh from your repository. Core runtime: Node.js 22.12+ or Bun 1.3+. Type inspection additionally requires Node and a trusted project-installed TypeScript 7.0.2 compiler; its adapter uses the version-specific unstable/sync API. No compiler is auto-installed.

Breaking changes and migration

• Generated graph IDs change. Run refresh after upgrading and update external references to generated IDs. Human-owned semantic/overlay inputs are preserved; old compiled graph formats remain readable.
• Invalid/empty targets and certain JSON diagnostics now return nonzero instead of false success.
• REA imports require --rea-direction forward or backward; regenerate imports whose direction was not recorded.
• The ignored trace --depth option and verify --init are retired. Use bounded context queries and explicit reference mappings.

See the migration guide, full changelog, type contract limits, and security review.

Verification and artifacts

Source: 1d6ebeed3f390ce7dbd8408bed8177114489ea3c. Merged-source CI passed the six runtime rows; the final suite passed 133 tests / 2,124 assertions / one snapshot. The publisher tested one archive on Node 22.12/24/26 and Bun 1.3.14/1.4.4 before publishing with npm provenance. Fresh public-registry npm and Bun installations passed CLI, spec, type invalid/repair, evidence-tamper, REA and real stdio MCP checks; npm signature verification passed.

• dotdog-1.0.0.tgz: the original published npm archive, not a rebuild.
• release.json: source commit, file manifest, size, SHA-256 and SHA-512 integrity for that archive.
• dotdog-spec-kit-extension-v1.0.0.zip: optional Spec Kit extension, with its checksum. Published-asset verification installed it with pinned Spec Kit 0.12.0 and 1.2.5.
• SHA256SUMS.txt: checksums for the attached archive, receipt and extension files.

To download and check the attached files:

gh release download v1.0.0 --repo specdog/dotdog
shasum -a 256 -c SHA256SUMS.txt

npm and Bun use the same npm registry package; there is no separate Bun publication. Homebrew and the separate Rust port are not represented as upgraded by this release.

Known limits

Graph coverage and type inspection are partial evidence, not proof of requirement satisfaction or runtime correctness. REA support is a saved-export adapter, not a general Ghidra loader. Authenticated model-driven Claude invocation/edit-refresh remains unverified; deterministic host discovery/removal and CLI/MCP checks do not establish model productivity. See the linked guides for supported configurations and failure behavior.

All changes since 0.9.0. Report bugs through issues; report vulnerabilities privately through the security policy.